In the previous post I went through the numbers on VPN and remote access attacks this spring. Here is what I think management should take away from them.<\/p>\n
First, the attackers move faster than our change processes. A VPN patch that waits for the next quarterly maintenance window is a patch that comes too late. Ask your IT department how long it takes from a critical patch on an internet facing system until it is installed. If the answer is weeks, change the process.<\/p>\n
Second, patching is not the end of an incident. If a system was vulnerable and exposed, assume someone may have used it. Ask for the logs to be checked and the passwords changed. It is not expensive and it can save you a lot.<\/p>\n
Third, remote access is now critical infrastructure. The whole company depends on it. That means it needs an owner, a budget, monitoring and a plan for what happens when it stops working.<\/p>\n
Fourth, the decisions you took in March to get people working from home need to be reviewed. Some of the doors opened in a hurry are still open.<\/p>\n
The good news is that none of this is new or particularly expensive. It is about priority.<\/p>\n
The attackers already decided that your remote access is a priority. You should too.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the previous post I went through the numbers on VPN and remote access attacks this spring. Here is what I think management should take away from them. First, the attackers move faster than our change processes. A VPN patch that waits for the next quarterly maintenance window is a patch that comes too late. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,40,62],"class_list":["post-1211","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-risk-management","tag-vpn"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1211","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1211"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1211\/revisions"}],"predecessor-version":[{"id":1239,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1211\/revisions\/1239"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1211"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}